<!DOCTYPE html>
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
        <title>iRedMail Easy: Setup sudo for deployment</title>
        <link rel="stylesheet" type="text/css" href="./css/markdown.css" />
    </head>
    <body>

    <div id="navigation">
    <a href="https://www.iredmail.org" target="_blank">
        <img alt="iRedMail web site"
             src="./images/logo-iredmail.png"
             style="vertical-align: middle; height: 30px;"
             />&nbsp;
        <span>iRedMail</span>
    </a>
    &nbsp;&nbsp;//&nbsp;&nbsp;<a href="./index.html">Document Index</a></div><h1 id="iredmail-easy-setup-sudo-for-deployment">iRedMail Easy: Setup sudo for deployment</h1>
<div class="admonition attention">
<p class="admonition-title">Attention</p>
<p>Check out the lightweight on-premises email archiving software developed by iRedMail team: <a href="https://spiderd.io/">Spider Email Archiver</a>.</p>
</div>
<div class="toc">
<ul>
<li><a href="#iredmail-easy-setup-sudo-for-deployment">iRedMail Easy: Setup sudo for deployment</a><ul>
<li><a href="#what-is-sudo-linux-and-doas-openbsd">What is sudo (Linux) and doas (OpenBSD)</a></li>
<li><a href="#linux-setup-sudo">Linux: Setup sudo</a></li>
<li><a href="#openbsd-setup-doas">OpenBSD: Setup doas</a></li>
<li><a href="#references">References</a></li>
</ul>
</li>
</ul>
</div>
<h2 id="what-is-sudo-linux-and-doas-openbsd">What is <code>sudo</code> (Linux) and <code>doas</code> (OpenBSD)</h2>
<p>From <a href="https://en.wikipedia.org/wiki/Sudo">wikipedia</a>:</p>
<blockquote>
<p>sudo is a program for Unix-like computer operating systems that allows users
to run programs with the security privileges of another user, by default the
superuser <code>root</code>. It originally stood for "superuser do" as the older versions
of sudo were designed to run commands only as the superuser. However, the later
versions added support for running commands not only as the superuser but also
as other (restricted) users, ...</p>
<p>Unlike the similar command <code>su</code>, users must, by default, supply their own
password for authentication, rather than the password of the target user.
After authentication, and if the configuration file, which is typically
located at <code>/etc/sudoers</code>, permits the user access, the system invokes the
requested command. The configuration file offers detailed access permissions,
including enabling commands only from the invoking terminal; requiring a
password per user or group; requiring re-entry of a password every time or
never requiring a password at all for a particular command line. It can also
be configured to permit passing arguments or multiple commands.</p>
</blockquote>
<p>OpenBSD uses its own sudo-like program for this purpose, it's called <code>doas</code>
which means <em><strong>execute commands as another user</strong></em>.</p>
<p>With the iRedMail Easy, you can deploy iRedMail by connecting to
target server (via ssh) as a non-privileged user (e.g. user <code>iredmail</code>) which
is allowed to run command as <code>root</code> with <code>sudo</code>.</p>
<h2 id="linux-setup-sudo">Linux: Setup sudo</h2>
<p>Let's say you're going to connect as user <code>iredmail</code>:</p>
<ul>
<li>
<p>Run command <code>visudo</code> as root user.</p>
<p>Although you can edit sudo config file <code>/etc/sudoers</code> with your favourite
text editor, but <code>visudo</code> will help check syntax while saving changes. this
is helpful to avoid some mistakes like misspelled username, or any other
keyword.</p>
</li>
<li>
<p>Add lines below at the end, save your changes and quit <code>visudo</code>.</p>
</li>
</ul>
<pre><code># Allow user `iredmail` to run all commands without typing its own password.
iredmail  ALL=(ALL) NOPASSWD: ALL

# We're going to connect without a real tty, below setting will speed up the
# iRedMail deployment process.
Defaults:iredmail !requiretty
</code></pre>
<p>To verify the sudo configuration, please login as user <code>iredmail</code> first, then run
command:</p>
<pre><code>sudo ls /root/
</code></pre>
<p>If sudo is correctly configured, it will show you list of files under <code>/root</code>
directory.</p>
<h2 id="openbsd-setup-doas">OpenBSD: Setup doas</h2>
<p>Let's say you're going to connect as user <code>iredmail</code>.</p>
<p>Append line below to file <code>/etc/doas.conf</code> (if this file doesn't exist, please
create it manually):</p>
<pre><code>permit nopass iredmail as root
</code></pre>
<p>To verify the sudo configuration, please login as user <code>iredmail</code> first, then run
command:</p>
<pre><code>doas ls /root/
</code></pre>
<p>If sudo is correctly configured, it will show you list of files under <code>/root</code>
directory.</p>
<h2 id="references">References</h2>
<ul>
<li>Linux <code>sudo</code>:<ul>
<li><a href="https://www.sudo.ws/man/1.8.3/sudo.man.html">sudo manual page</a></li>
<li><a href="https://www.tecmint.com/sudoers-configurations-for-setting-sudo-in-linux/">10 Useful Sudoers Configurations for Setting ‘sudo’ in Linux</a></li>
<li><a href="https://www.tecmint.com/su-vs-sudo-and-how-to-configure-sudo-in-linux/">Difference Between su and sudo and How to Configure sudo in Linux</a></li>
</ul>
</li>
<li>OpenBSD <code>doas</code>:<ul>
<li><a href="https://man.openbsd.org/doas.conf.5">doas(5) manual page</a></li>
<li><a href="https://man.openbsd.org/doas.1">doas(1) manual page</a></li>
</ul>
</li>
</ul><div class="footer">
    <p style="text-align: center; color: grey;">All documents are available in <a href="https://github.com/iredmail/docs/">GitHub repository</a>, and published under <a href="http://creativecommons.org/licenses/by-nd/3.0/us/" target="_blank">Creative Commons</a> license. You can <a href="https://github.com/iredmail/docs/archive/master.zip">download the latest version</a> for offline reading. If you found something wrong, please do <a href="https://www.iredmail.org/contact.html">contact us</a> to fix it.</p>
</div></body></html>